CVE-2024-38144: Windows 10 Privilege Escalation Flaw

CVE-2024-38144 Overview

CVE-2024-38144 is an elevation of privilege vulnerability in the Microsoft Windows Kernel Streaming WOW Thunk Service Driver. The flaw stems from an integer overflow or wraparound condition [CWE-190] in the driver's thunking layer, which bridges 32-bit Windows-on-Windows (WOW) calls to the 64-bit kernel streaming subsystem. A local attacker with low privileges can exploit the issue to gain SYSTEM-level execution on affected Windows endpoints and servers. Microsoft published the advisory on August 13, 2024, covering all supported Windows 10, Windows 11, and Windows Server releases.

Critical Impact
Successful exploitation grants SYSTEM privileges, allowing attackers to disable security tooling, install persistent malware, and pivot across the host. The EPSS score of 79.806% (99.115 percentile) indicates a high likelihood of exploitation activity.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (21H2, 22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-08-13 - CVE-2024-38144 published to NVD
2024-08-13 - Microsoft releases security update via Microsoft CVE-2024-38144 Update
2024-08-16 - Last updated in NVD database

Technical Details for CVE-2024-38144

Vulnerability Analysis

The Kernel Streaming WOW Thunk Service Driver translates I/O control requests issued by 32-bit user-mode processes into structures consumable by the 64-bit kernel streaming stack. During this translation, the driver performs arithmetic on size and offset fields supplied by the caller. An integer overflow condition causes computed buffer sizes to wrap, producing allocations smaller than required while subsequent copy operations use the original, untruncated length.

The result is a controlled memory corruption primitive in kernel address space. An attacker who already has the ability to execute code as a standard user can chain this primitive to overwrite kernel objects, escalate the access token of their process, and obtain SYSTEM privileges. The vulnerability category aligns with the broader class of Windows kernel driver thunk flaws that Microsoft has patched repeatedly across the WOW64 subsystem.

Root Cause

The defect is an integer overflow [CWE-190] in input validation logic inside the WOW thunking path of the kernel streaming driver. Length or count fields originating from a 32-bit process are multiplied or added without sufficient bounds checking before being passed to allocator and copy routines.

Attack Vector

Exploitation requires local code execution as an authenticated low-privilege user. The attacker opens a handle to a kernel streaming device, then issues crafted IOCTL requests through the WOW thunk interface containing field values designed to trigger the overflow. No user interaction is required beyond the attacker's own process. The vulnerability is typically chained after an initial access vector such as phishing, a browser exploit, or credential theft.

No public proof-of-concept or exploit code has been published at this time, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-38144

Indicators of Compromise

Unexpected child processes of low-privilege parents running with SYSTEM or NT AUTHORITY\SYSTEM token context.
Process access or handle duplication targeting lsass.exe or other protected processes from non-administrative origins.
Loading of, or repeated IOCTL traffic to, kernel streaming device objects (for example \Device\KsecDD-adjacent streaming endpoints) by unusual user-mode binaries.
Bug check events (BSOD) referencing the kernel streaming WOW thunk driver during exploitation attempts.

Detection Strategies

Hunt for token manipulation patterns: a thread or process whose primary token changes from a standard user SID to SYSTEM mid-execution.
Correlate Sysmon Event ID 1 (process creation) with Event ID 10 (process access) to surface low-privilege processes obtaining PROCESS_ALL_ACCESS to higher-integrity processes.
Monitor Windows kernel-mode driver telemetry for unexpected userland callers issuing kernel streaming IOCTLs from 32-bit processes on 64-bit hosts.

Monitoring Recommendations

Enable kernel audit policies for Audit Sensitive Privilege Use and Audit Process Creation with command-line logging.
Forward EDR and Sysmon telemetry to a centralized data lake for retrospective hunting on integer-overflow style kernel exploitation patterns.
Track installations of unsigned or unusual drivers on endpoints that should not host development tooling.

How to Mitigate CVE-2024-38144

Immediate Actions Required

Apply the August 2024 Microsoft security update referenced in the Microsoft CVE-2024-38144 Update advisory across all Windows 10, Windows 11, and Windows Server hosts.
Prioritize patch deployment on multi-user systems, jump hosts, and any endpoint exposed to phishing or browser-delivered initial access.
Audit local administrator group membership and remove unnecessary standing privileges to limit chained exploitation impact.

Patch Information

Microsoft addressed CVE-2024-38144 in the August 13, 2024 Patch Tuesday cumulative updates. Refer to the Microsoft Security Response Center advisory for the specific KB articles applicable to each Windows build. There are no supported configurations exempt from the update; all listed Windows 10, Windows 11, and Windows Server versions require the patch.

Workarounds

No official vendor workaround exists. Microsoft directs administrators to install the security update.
Where patching is delayed, enforce application allowlisting (such as Windows Defender Application Control) to block untrusted 32-bit binaries that could invoke the vulnerable thunk path.
Restrict local logon rights and remove interactive access for service accounts to reduce the population of users able to trigger the local attack vector.

bash

# Verify the August 2024 cumulative update is installed on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Query for the specific KB referenced in the MSRC advisory (replace KBNNNNNNN)
wmic qfe get HotFixID,InstalledOn | findstr /I "KBNNNNNNN"